Skip to content

Fix snap boot kernel path (Bugfix)#884

Merged
pieqq merged 5 commits intomainfrom
fix_secure_boot_mode_snappy
Jan 10, 2024
Merged

Fix snap boot kernel path (Bugfix)#884
pieqq merged 5 commits intomainfrom
fix_secure_boot_mode_snappy

Conversation

@nancyc12
Copy link
Copy Markdown
Contributor

@nancyc12 nancyc12 commented Dec 11, 2023

Description

As describe in this snap doc, to access to host’s snap-related files, it's now have to access via /var/lib/snapd/hostfs. This system-backup interface gives privileged read-only access to system data. The change can be traced back to snapd 2.36.

Resolved issues

Resolve failed test case miscellanea/secure_boot_mode_kdrp-kdrp-k4500-gadget in denver SUV test.

dumpimage: Can't open "/boot/uboot/avnet-avt-iiotg20-kernel_70.snap/kernel.img": No such file or directory

Documentation

The test case impacted is miscellanea/secure_boot_mode_{gadget}. Confirmed with QA that the most of the IoT projects use their own project checkboxs, which already include this boot kernel path change in boot_mode_test_snappy.py. The only exception is denver project, that its provider uses boot_mode_test_snappy.py in general checkbox provider. Other than that, miscellanea/secure_boot_mode_{gadget} is not included in any test plan in checkbox itself,

Tests

Test on denver-keurig-001 with side-loaded checkbox.

avnet@ubuntu:/var/tmp/checkbox-providers/bin$ sudo checkbox-denver.shell 
checkbox-denver runtime shell, type 'exit' to quit the session
root@ubuntu:/var/tmp/checkbox-providers/bin# chmod +x boot_mode_test_snappy.py 
root@ubuntu:/var/tmp/checkbox-providers/bin# ./boot_mode_test_snappy.py kdrp-kdrp-k4500-gadget avnet-avt-iiotg20-kernel
Bootloader is u-boot

Parsing FIT image information...

Checking object kernel@1
Found "Sign value"
Found expected signing algorithms

Checking object ramdisk@1
Found "Sign value"
Found expected signing algorithms

Checking object config@1
Found "Sign value"
Found expected signing algorithms

Kernel images in current snap and u-boot match

Secure Boot appears to be enabled on this system

@codecov
Copy link
Copy Markdown

codecov bot commented Dec 11, 2023

Codecov Report

Attention: 9 lines in your changes are missing coverage. Please review.

Comparison is base (9f23c20) 35.70% compared to head (d7aa02c) 36.04%.
Report is 42 commits behind head on main.

Files Patch % Lines
providers/base/bin/boot_mode_test_snappy.py 40.00% 9 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main     #884      +/-   ##
==========================================
+ Coverage   35.70%   36.04%   +0.33%     
==========================================
  Files         303      303              
  Lines       34250    34265      +15     
  Branches     5917     5918       +1     
==========================================
+ Hits        12230    12350     +120     
+ Misses      21458    21350     -108     
- Partials      562      565       +3     
Flag Coverage Δ
provider-base 6.14% <40.00%> (+0.84%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Copy Markdown
Collaborator

@pieqq pieqq left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I remember our conversation about this. Thanks for the PR!

We now require every test script in the providers to have enough test coverage. This script has none.

At the very least, the changes that you made should be tested. I usually tell contributors to just test the function(s) they modified (or created), but in this case, your changes are in main(), and main() is most of this script!

You can try to split the part that you modified and make it its own function, and then write unit tests for this function. See our contrib guide for more info, or don't hesitate to ping me if you need help.

pieqq
pieqq previously approved these changes Jan 10, 2024
Copy link
Copy Markdown
Collaborator

@pieqq pieqq left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good! I think you can reduce the sample data file to the bare minimum required to run your tests, but it's not a big deal anyway.

Co-authored-by: Pierre Equoy <pierre.equoy@canonical.com>
Copy link
Copy Markdown
Collaborator

@pieqq pieqq left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@pieqq pieqq merged commit 45f1137 into main Jan 10, 2024
@pieqq pieqq deleted the fix_secure_boot_mode_snappy branch January 10, 2024 09:50
LiaoU3 pushed a commit to LiaoU3/checkbox that referenced this pull request Mar 20, 2024
As describe in this snap doc[1], to access to host’s snap-related files, it's now have to access via /var/lib/snapd/hostfs. This system-backup interface gives privileged read-only access to system data. The change can be traced back to snapd 2.36.

[1] https://snapcraft.io/docs/the-system-backup-interface

* fix snap boot kernel path

* add comment for reference

* add unit test for boot_mode_test_snappy.py

* amend for flake8 check

* remove unnecessary test data

Co-authored-by: Pierre Equoy <pierre.equoy@canonical.com>

---------

Co-authored-by: Pierre Equoy <pierre.equoy@canonical.com>
binli pushed a commit to binli/checkbox that referenced this pull request Mar 22, 2024
As describe in this snap doc[1], to access to host’s snap-related files, it's now have to access via /var/lib/snapd/hostfs. This system-backup interface gives privileged read-only access to system data. The change can be traced back to snapd 2.36.

[1] https://snapcraft.io/docs/the-system-backup-interface

* fix snap boot kernel path

* add comment for reference

* add unit test for boot_mode_test_snappy.py

* amend for flake8 check

* remove unnecessary test data

Co-authored-by: Pierre Equoy <pierre.equoy@canonical.com>

---------

Co-authored-by: Pierre Equoy <pierre.equoy@canonical.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants